Jashn Wahi

Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository.

**Name of the Vulnerable Software and Affected Versions** Volmarg Personal Management System (affected versions not specified) **Description** Authenticated attackers can read arbitrary files by providing absolute filesystem paths to the 'GET /public/get-file/{path}' endpoint. This occurs because the `path` route parameter is passed directly to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form to prevent bypassing security checks. This allows the retrieval of sensitive files accessible to the PHP-FPM worker process without requiring directory traversal sequences. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `path` parameter in the 'GET /public/get-file/{path}' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Volmarg Personal Management System (affected versions not specified) DrayTek VigorAP (affected versions not specified) **Description** Volmarg Personal Management System allows authenticated attackers to read arbitrary files via the 'GET /public/get-file/{path}' endpoint. The `path` route parameter is passed to the `file get contents()` function without canonicalization, which is the process of converting a path to its simplest, standard form, allowing the retrieval of sensitive files accessible to the PHP-FPM worker process. DrayTek VigorAP models contain a command injection flaw in the `ExportSettings()` function. Insufficient filtering of the `backupkey`, `backuptype`, and `realtime` fields allows a remote attacker with administrative credentials to execute arbitrary commands with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Joomla version 6.1.1 **Description** A path traversal issue exists in the `com joomlaupdate` extension. A Super User can be tricked into extracting a specially crafted archive containing absolute paths or directory traversal sequences in ZIP entry filenames. By providing these malicious names to the `extract.php` extraction routine, files can be written outside the intended destination root, which allows for persistent remote code execution through the placement of PHP files. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.